PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-5135 SonicWall CVE debrief

CVE-2020-5135 is a SonicWall SonicOS buffer overflow vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 2022-03-15. CISA’s catalog entry instructs defenders to apply updates per vendor instructions, and the remediation due date in the KEV record is 2022-04-05. Because it is on the KEV list, organizations using SonicWall SonicOS should treat it as a priority patching item and verify remediation status promptly.

Vendor
SonicWall
Product
SonicOS
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-03-15
Original CVE updated
2022-03-15
Advisory published
2022-03-15
Advisory updated
2022-03-15

Who should care

Organizations that operate SonicWall SonicOS, including security operations teams, vulnerability management teams, and system owners responsible for SonicWall appliances or deployments.

Technical summary

The official source corpus identifies the issue as a buffer overflow vulnerability in SonicWall SonicOS. CISA lists it in the KEV catalog and directs organizations to apply updates per vendor instructions. The provided sources do not include affected version ranges, exploit details, or a CVSS score, so remediation planning should rely on the vendor’s guidance and the official CVE/NVD records.

Defensive priority

Urgent. CISA placed CVE-2020-5135 in the KEV catalog on 2022-03-15 and set a remediation due date of 2022-04-05, which makes it a high-priority vulnerability for asset owners to confirm and remediate.

Recommended defensive actions

  • Identify all SonicWall SonicOS assets in your environment and confirm whether they are affected.
  • Apply vendor-recommended updates as directed by SonicWall and referenced by CISA.
  • Verify remediation before the KEV due date or as soon as operationally possible if still unpatched.
  • Use the official CVE and NVD records to confirm any additional vendor or version details.
  • Document patch status and exceptions, and retest affected assets after remediation.

Evidence notes

Evidence used here is limited to the official CISA KEV source item and the linked official CVE/NVD resources. The KEV metadata provides the vulnerability name, date added (2022-03-15), due date (2022-04-05), and required action ('Apply updates per vendor instructions.'). The source corpus does not provide exploit code, affected version ranges, or other technical specifics.

Official resources

Prepared only from the supplied official source corpus and linked official resources (CISA KEV, CVE.org, and NVD). No exploit instructions, reproduction steps, or unsupported technical claims are included.